ISO 27001

ISO 27001 sets the requirements for an information security management system, known as an ISMS. An organisation fixes the scope of the system, assesses its risks, chooses how to treat them, and records the result in a Statement of Applicability that names the Annex A controls it has adopted and explains any it has left out. A certification body then audits the system in two stages before a certificate is issued.

The 2022 edition of Annex A sets out 93 controls in four themes: organisational, people, physical, and technological. Every adopted control needs an owner, a working implementation, and evidence that it runs on schedule. Access reviews, tested backups, supplier checks, and training records are the artefacts auditors ask for first, because they prove the system operates between audits and not just on paper.

Certification runs on a three-year cycle, and the system behind it is expected to work continuously. Internal audits, management reviews, and corrective actions fill the year, and the certification body returns for surveillance audits in the second and third years. A lapse found at surveillance can suspend the certificate, so the calendar of reviews matters as much as the controls themselves.